Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   DnlibEditor (https://forum.exetools.com/showthread.php?t=16199)

CodeCracker 09-23-2014 02:20

DnlibEditor
 
1 Attachment(s)
DnlibEditor is an assembly editor and runs as a plug-in for Red Gate's Reflector.
DnlibEditor is using dnlib by 0xd4d and is able to manipulate IL code and save
the modified assemblies to disk.
DnlibEditor is a replacer for Reflexil plugin.

Separator for Decimal symbol is the one specific for each language -
look on Control Panel for "Regional and Language Options".
Array separator (i.e. for constants) is the ',' char!

Generic type ("-> Generic type refence") are not supported!!

For Windows 64 bit:
DnlibEditor.dll is an 32 bit assembly so can't be loaded
by 64 bit processes like Reflector.exe
So load Reflector.exe on your favorite PE editor
(CFF Explorer is a good one), goto .NET Directory and change
the Flags value: make sure the "32bit required" flag is marked!

Changing Reflector version:
You will need to change the Reflector assembly version
since it has a reference to old Reflector 7.0 version!
For this task use ReferencedVersionChanger! (attached)
Simply add DnlibEditor.dll to the list by clicking "Add files" button
and after that click the "Get them from file" button and select
your Reflector.exe file!
Finish it using Execute button!

Let me know about any bug you may find!

0xd4d 09-23-2014 22:46

Some questions CodeCracker. (I don't use Reflector at all)

Does it support mixed mode assemblies?

Is it not possible to build it as AnyCPU so it can be loaded without modifying Reflector?

CodeCracker 09-25-2014 01:45

It should support mixed mode assemblies!

As for AnyCPU I've tried to set it with SharpDevelop 4.0!
But Reflector was not able to load even some simple plugins!
Do you know which are the differences between AnyCPU and x32 assemblies?

0xd4d 09-25-2014 02:07

The difference is that AnyCPU should be usable by any .NET DLL (32-bit or 64-bit or AnyCPU executable), but x86-only can only be loaded by 32-bit processes.

CodeCracker 09-25-2014 02:21

What I mean: what are the actual differences? I know that for AnyCPU "32bit required" flag
should be unmarked! But what other differences are?

0xd4d 09-25-2014 03:43

AFAIK, that's the only difference between an AnyCPU assembly and an x86-only assembly.

CodeCracker 09-25-2014 05:01

Quote:

Originally Posted by 0xd4d (Post 94790)
AFAIK, that's the only difference between an AnyCPU assembly and an x86-only assembly.

100% correct! The problem was my ungenuine Reflector!
So all we have to do is umarking "32bit required" flag for both Reflector.exe and DnlibEditor.dll
Go to .NET Directory and change the Flags value: make sure the "32bit required" flag is unmarked!
Tested on Windows 7 64 bits and all seems to work ok!

s0me0n3 09-25-2014 07:16

May I ask what is better on it compared to Reflexil? I mean, if it's basically doing the same without any difference/advantage, it wouldn't make sense to code it so there has to be something different and I would like to know what it is before I replace Reflexir.
Would you mind explaining it to me and others eventually going to use it? :)

CodeCracker 09-25-2014 17:53

The major difference is migrating from Mono.Cecil to dnlib! You should keep in mind that dnlib is much better then Mono.Cecil!
As a result mixed mode assemblies are supported!
Also when you save the module definition all tokens are preserved, when you save the assembly definition tokens are not preserved.

wilson bibe 10-06-2014 17:02

This tool that you developed is amazing, for those who like reverse engineering regarding "net assembly" will certainly think twice before using the reflexil, because this does not support the mixed mode. I tested it in some net assembly in "mixed mode" and works very fine. Thank You CodeCracker

CodeCracker 12-04-2014 23:25

What's new:
- Some bugs fixed;
- Save assembly/module changed, now shows a form with two options:
- "Perserve" - perserve tokens and streams
- "KeepOldMaxStack" - if you select this option you will be able to save obfuscated assemblies.

s0me0n3 12-15-2014 17:41

After some testing your first version, I am pretty happy you actively develop and maintain it.
One request:
If you entered eg ldc.i4.1 manually through pasting via clipboard, it refused to save it. You have to select it with your mouse so it gets accepted, pretty annoying in some cases where you enter some quick command with your keyboard and it refuses to accept it.
This behaviour however does not occur with Reflexir so I guess there is some small messup. Any quick and clean way to fix this, too if not done already? Thanks in advance.

s0me0n3 12-15-2014 18:48

My edit wasn't saved, servers are slow these days for me:
I quickly checked your latest version. It still selects 'add' instead of your manually entered command. Please fix it, it's going to add alot usability imo.

CodeCracker 09-28-2015 19:26

DnlibEditorFixedEdition
 
- Fixed: now you can simply paste the opcode
(as text for exemple ldc.i4.1) in opcode combo,
- Added: NoThrowInstance when saving assemblies

CodeCracker 10-11-2015 21:04

On instructions added
 
1 Attachment(s)
On instructions added:
- Search for opcode or operand
- Go to instruction index or instruction offset


All times are GMT +8. The time now is 06:14.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX